MungPlex
MungPlex is a game hacking utility suitable for many emulators. It allows searching for memory addresses,
executing cheats as Lua scripts and searching for pointer paths. Besides this it features a memory viewer and
data conversion window. You can even execute Lua cheats on PC games. Searching for cheats on PC games is yet not possible.
The term MungPlex refers to the possibility to mess (mung) with games in many different ways (-plex). It is an open source project developed by Lawn Meower (aka CosmoCortney) and open for anyone to contribute.
Supported Emulators
Many of the most commonly used emulators are supported:
- Project 64 - Nintendo 64
- Dolphin - GameCube, Wii, WiiWare, VC
- Cemu - Wii U
- VirtualBoy Advance - GameBoy (Color/Advance)
- DesMume - Nintendo DS
- Citra - 3DS (experimental)
- ePSXe - PlayStation
- PCSX2 - PlayStation 2 (experimental)
- RPCS3 - Plastation 3 (experimental)
- PPSSPP 1.9.3 <x64> - PSP (may also work with later releases)
- Fusion 3.64 - Master System, Mega Drive/Genesis, Sega CD (Experimental), Game Gear
- Yabause v0.9.15 - Sega Saturn
- nullDC 1.0.4 - Sega Dreamcast
Project 64 Support
There's a signifcant problem to consider: Even though N64's memory mapping is Big Endian, PJ64 uses Little Endian memory mapping.
Each 4 byte sequence is stored in Little Endian byte order. Every byte's address ending with 0, 4, 8 or C is 3 bytes lower than its address.
Byte addresses ending with 1, 5, 9 and D are 1 byte lower. Byte addresses ending with 2, 6, A and E are 1 byte bigger and addresses ending with 3, 7, B and F are 3 bytes bigger.
N64: 0x0011223344556677 - PJ64: 0x3322110077665544
N64: ABCDEFGH - PJ64: DCBAHGFE
You can search for 32-bit, 16-bit and 8-bit values just fine. BUT in Little Endian mode AND 32-bit and 16-bit searches should be aligned.
Searching for Doubles is impossible and searching for 64-bit integers is very impractical.
Dolphin Support
Consider not altering the memory sizes under General Settings.
PCSX2 and RPCS3 Support
It seems like these emulators store the emulated memory in many little chunks. Therefore it is impossible creating consistent cheats for them.
System Requirements
In order to use MungPlex you need a computer running Windows without restricted access. Certain restrictions in user rights won't allow you
to connect MungPlex to other processes.
If you wanna search for cheats for systems with higher memory sizes (PS3, Wii U, 3DS) you need a computer with lots of RAM.
An unaligned full-range search takes about 9 times the memory used by target range. However, it is possible to manually reduce the memory range for the search process.
Running MungPlex for the first time
When running MungPlex for the first time it will tell you that certain settings have yet not been made. Please go to the Settings tab and configure the reguired settings.
Connecting MungPlex to an emulator or game
In the top-left corner you can find a connection box. Select the target emulator from the DropBox and click Hook.
If you want to connect MungPlex to a PC game select PC from the DropBox and Hook. A new window will open where you can select the process or game to open.
The Connection box will tell you if the connection was successful.
Searching for cheats/addresses
The Search tab features all neccesary options to search for cheats and memory addresses.
Range Options
Here you can define the memory range and exact area where to search for cheats.
Under Memory Range you can select any mapped region of the Game. Start at allows you to define where you wish start scanning on the selected range.
End at expresses the last byte's location of the area you wish to scan. This can help speeding up the search process and reduce memory usage. By default the
entirity of the selected range is expressed. It is not recommended expressing a scanning area bigger than 0x10000000 (or 256MB) since this can occupy
too much memory of your computer. If you do this, be aware of what you are doing.
Value Type Options
Here you can select the value type. A detailed explaination of all datatypes is given here.
As of now MungPlex supports
searching for integers (8, 16, 32 and 64 bits) and floats (single and double precision).
The Signed check box allows you to define wheather to search for signed or unsigned integers. This is ignored when working with floats.
Big Endian differentiates whether values should be interpreted in the Least significant byte first order (Little Endian) or
Most significant Byte First order (Big Endian). The best option is auto-selected but in same cases you may wish to change it.
Search Options
Here you can select and perform search actions. The Search Condition allows you whether to search for a specific value (Known Value)
or a value relative to the previous scan (Unknown Value). Next to it you can select the filter condition. You can read more on this here.
The Button Start/Next triggers the search process. Cancel cancels and resets the current search process.
When doing comparision according to a specific value (Known Value Search) you can enter the value under Known:.
Check Aligned if you want to perform aligned searches. An aligned search scans values in 4-byte steps. This speeds up the search process and
gets rid of most junk values. But in some cases you might want to leave this option unused.
If you wish to view and enter all values as hexadecimal number you should check Values Are Hex. This option is ignored when searching for floats.
Testing Results
If you think you have filtered out enough junk data you can start testing values. The Address column shows all possible addresses.
The column labeled Current shows the lastly scanned values for each address. The column Previous shows the previous value.
Difference shows the absolute difference between those.
To test any address simply click one entry and type in any value to test. Then click Poke to write the value to the game once.
If you wanna write the previouse value simply check Previous. What ever is inside the value's TextBox is then ignored. If you want to
test multiple values at once you can do so as well. Select Multiple values (CTRL + A to select all,
Click then Shift + Click to select a certain range of results, CTRL + Click to select as many individual values as you wish.
The value entered into the value's TextBox will be written to all selected addresses. If you have Previous checked all addresses' previous value
will be written to the game.
Creating and executing Lua Cheats
Thanks to MungPlex it is possible writing any Lua code to execute cheat codes. However, in order to manipulate games some extra functionalities have been added.
WriteToRAM Function
This function is being used to write any value to the game.
WriteToRAM(TYPE, ADDRESS, VALUE)
- TYPE: Datatype
- INT8: 8-Bit integer
- INT16: 16-Bit integer
- INT32: 32-Bit integer
- INT64: 64-Bit integer
- FLOAT: Float of single precision
- DOUBLE: Float of double precision
- BOOL: Boolean
- ADDRESS: Address where the VALUE is to be written
- VALUE: Value of TYPE to be written to ADDRESS
Examples:
Writing a floating-point value of 150.0 to 0x813b5a28
WriteToRAM(FLOAT, 0x813b5a28, 150.0)
Writing a 32-bit Integer of 0x42000000 to an address held in a variable + added offset
WriteToRAM(FLOAT, ptr + 0x1E8, 16.0)
ReadFromRAM Function
This function is being used to read and return any value from the game.
ReadFromRAM(TYPE, ADDRESS)
- TYPE: Datatype
- INT8: 8-Bit integer
- INT16: 16-Bit integer
- INT32: 32-Bit integer
- INT64: 64-Bit integer
- FLOAT: Float of single precision
- DOUBLE: Float of double precision
- BOOL: Boolean
- ADDRESS: Address where the VALUE is to be written
- VALUE: Value of TYPE to be written to ADDRESS
Examples:
Reading a 32-bit value from 0x801B61AC
ptr = ReadFromRAM(INT32, 0x801B61AC)
Reading a 32-bit value from 0x801B61AC, checking whether the value is in a certain range, adding an offset and doing a float-write to it
ptr = ReadFromRAM(INT32, 0x801B61AC)
if(ptr > 0x80B00000 and ptr < 0x80D00000) then
WriteToRAM(FLOAT, ptr + 0x1E8, 16.0)
end
As you can see we are processing a pointer path here. You can read more on operating pointers with MungPlex-rekated Lua scripts here
LogToGUI
Writes any value to MungPlex' UI.
val = ReadFromRAM(INT32, 0x80CD650C)
LogToGUI(val)
ClearGUI
Clears the UI print area
ClearGUI()
Global Variables
MungPlex features global variables for each datatype. These can be used to keep values after cheat execution and share them between other cheats. Each datatype offers 32 such registers.
- INTREG00 - INTREG31: Registers for integer values
- NUMREG00 - NUMREG31: Register for floats and doubles
- BOOLREG00 - BOOL31: Boolean registers
NUMREG00 = NUMREG00 + 0.05
val = math.sin(NUMREG00)
val = math.abs(val)
WriteToRAM(FLOAT, 0x8037c0ec, val)
The above code increases NUMREG00 by 0.05 on each execution cycle. This value is then processed by a the math.sin() function to return a value which is growing and shrinking.
Retrieving Modules
This is only relevant for PC games. Many times pointer paths start withing a Module (DLL, exe) which memory address is not always the same. MungPlex' Lua implementation allows you to retrieve the game's Modules' memory addresses via the global table Modules.
ptr = Modules["mono.dll"] + 0x00265110
ptr = ReadFromRAM(INT64, ptr)
ptr = ReadFromRAM(INT64, ptr + 0x90)
ptr = ptr + 0x488
WriteToRAM(INT32, ptr, 30 * 60 * 666)
Entering Cheats
- Select Text from the Run cheats from GroupBox
- Write down the Lua script
- Click Execute Cheats to apply the Lua script
- Click Terminate Cheats to stop the Lua script from being executed
- If you wanna keep the Lua script click Save as... to save it. It will then appear in the Cheat List
Executing a list of Cheats
- Select Cheat List from the Run cheats from GroupBox
- Click Open Cheats Dir to open a directory containing all game-related cheats
- Select all wanted cheats by checking them in the list
- Click Execute Cheats
Cool Examples
Based on the example given above you can use the math.sin() function to let things grow and shrink. A more detailed example is given below:
speed = 0.01 -- 0.05 should be fine
factor = 5 -- 1.5 should be fine
offset = 0.5 -- 0.5 should be fine
NUMREG00 = NUMREG00 + speed
val = math.sin(NUMREG00)
val = math.abs(val)
val = val * factor
val = val + offset
WriteToRAM(FLOAT, 0x8037c0ec, val)
speed defines the growing/shrinking speed. factor the growing/shrinking radius and offset the growing/shrinking-radius position.
Pointer Search
A guide on finding pointers with MungPlex can be found here.